Tags: logstash-plugins/logstash-input-heartbeat
Tags
Populate '[event][sequence]' instead of 'clock' if ECS is enabled (#18) This PR does 3 things: * enable ECS compatibility, replacing the clock field with [event][sequence] when ECS is enabled * introduces a new option named sequence to configure the kind of counter used in the "clock/sequence" field * unrelated to the context of ECS it switches the creation of the Event to the event_factory mixin In non ECS mode the sequence setting takes precedence over message and if message contains a value other then epoch or sequence it includes also the message field in the generated event. In ECS mode only the sequence setting is considered to select the kind of counter, if message contains epoch or sequence its simply ignored and no message field is present in the event, otherwise message is part of the event together with the [event][sequence] Fixes #17 Co-authored-by: Ry Biesemeyer <yaauie@users.noreply.github.com> Co-authored-by: Karen Metts <35154725+karenzone@users.noreply.github.com> Co-authored-by: Karol Bucek <kares@users.noreply.github.com>
PreviousNext